MoustachedBouncer Attacking Foreign Embassies Using NightClub

MoustachedBouncer, a cyberespionage group active since 2014, likely has performed ISP-level adversary-in-the-middle (AitM) attacks since 2020 to compromise its targets.

For AitM, the MoustachedBouncer employs a lawful interception system like “SORM,” and besides this, it uses two toolsets that we have mentioned below:-

Cybersecurity researchers at ESET recently identified that MoustachedBouncer, reportedly backed by Belarus, targets foreign diplomats using its two toolsets that we have mentioned above from the following countries for nearly a decade:-

MoustachedBouncer Attacking Foreign Embassies

While it’s been suspected that MoustachedBouncer collaborated with Winter Vivern, active since 2021. Not only that even they also manipulated the victim’s ISP access and tricked the Windows 10 operating system with the imprisoned portal illusion.

ESET telemetry shows MoustachedBouncer targets embassies in Belarus, with staff from four countries affected:-

• Two from European
• One from South Asian
• One from African

Over time, the TTPs of the group evolved dramatically and it’s been active from 2014 to 2022. However, the AitM attacks by the group are observed in 2020, but, here the exceptional thing is that the targeted verticals remain the same.

MoustachedBouncer manipulates ISP to redirect victims in targeted IP ranges to deceptive, genuine-looking Windows Update URLs that we have mentioned below:-

• http://updates.microsoft[.]com/

Victims encounter fake Windows Update pages with urgent security alerts, in which users are provided with a button that is dubbed “Get updates,” clicking on it triggers malicious file download through executed JavaScript.

MoustachedBouncer’s AitM technique resembles Turla and StrongPity, which trojanize installers at the ISP level, similar to MoustachedBouncer’s approach.

It’s been suspected that the collaboration of MoustachedBouncer with Belarusian ISPs for a legal intercept system is completely similar to Russia’s SORM, executed by a 2016 mandate requiring telecom providers’ compatibility.

The HTML page fetches JavaScript from http://updates.microsoft[.]com/jdrop.js, scheduling function ‘jdrop’ after one second, which displays a modal with a ‘Get updates’ button.

Moreover, the MoustachedBouncer uses two implant families in parallel but deploys only one on a machine like:-

• Disco likely used with AitM
• NightClub for VPN-protected victims outside Belarus

Apart from this, NightClub has two primary capabilities, and here below we have mentioned them:-

• Monitoring files
• Exfiltrating data via SMTP (email)

All these key factors confirm that MoustachedBouncer is a skilled threat actor and actively targets the diplomats in Belarus by employing advanced techniques for C&C communication.

Advanced techniques that are observed:-

• For ISP-level interception it used Disco
• For emails, it used NightClub
• For DNS, it used the NightClub plugin

ESET started investigating in Feb 2022, finding a cyberattack on a European embassy. Analyzing the malware revealed a track dating to 2014, showcasing the group’s stealth in targeting diplomats.

Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.